[Configuration] Enforce sensitive configuration redaction at compile time - #8976
Draft
bm1549 wants to merge 7 commits into
Draft
[Configuration] Enforce sensitive configuration redaction at compile time#8976bm1549 wants to merge 7 commits into
bm1549 wants to merge 7 commits into
Conversation
bm1549
added
the
AI Generated
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8976) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (74ms) : 69, 79
master - mean (72ms) : 69, 75
section Bailout
This PR (8976) - mean (77ms) : 73, 81
master - mean (81ms) : 73, 89
section CallTarget+Inlining+NGEN
This PR (8976) - mean (1,089ms) : 1050, 1128
master - mean (1,096ms) : 1052, 1141
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (113ms) : 108, 118
master - mean (115ms) : 108, 121
section Bailout
This PR (8976) - mean (111ms) : 109, 113
master - mean (115ms) : 108, 122
section CallTarget+Inlining+NGEN
This PR (8976) - mean (786ms) : 767, 805
master - mean (785ms) : 763, 807
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (101ms) : 96, 106
master - mean (103ms) : 97, 109
section Bailout
This PR (8976) - mean (99ms) : 96, 102
master - mean (99ms) : 96, 103
section CallTarget+Inlining+NGEN
This PR (8976) - mean (947ms) : 900, 993
master - mean (950ms) : 901, 999
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (96ms) : 94, 99
master - mean (98ms) : 92, 105
section Bailout
This PR (8976) - mean (102ms) : 97, 107
master - mean (102ms) : 96, 108
section CallTarget+Inlining+NGEN
This PR (8976) - mean (819ms) : 781, 857
master - mean (822ms) : 782, 862
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (192ms) : 188, 195
master - mean (211ms) : 205, 217
section Bailout
This PR (8976) - mean (195ms) : 193, 197
master - mean (215ms) : 211, 219
section CallTarget+Inlining+NGEN
This PR (8976) - mean (1,174ms) : 1126, 1222
master - mean (1,268ms) : 1214, 1321
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (274ms) : 269, 278
master - mean (303ms) : 294, 312
section Bailout
This PR (8976) - mean (274ms) : 271, 277
master - mean (305ms) : 295, 315
section CallTarget+Inlining+NGEN
This PR (8976) - mean (938ms) : 922, 954
master - mean (1,009ms) : 984, 1035
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (268ms) : 265, 271
master - mean (298ms) : 291, 305
section Bailout
This PR (8976) - mean (268ms) : 265, 270
master - mean (297ms) : 291, 303
section CallTarget+Inlining+NGEN
This PR (8976) - mean (1,146ms) : 1109, 1183
master - mean (1,200ms) : 1160, 1239
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8976) - mean (266ms) : 262, 270
master - mean (300ms) : 294, 306
section Bailout
This PR (8976) - mean (266ms) : 264, 269
master - mean (301ms) : 293, 308
section CallTarget+Inlining+NGEN
This PR (8976) - mean (1,026ms) : 977, 1075
master - mean (1,094ms) : 989, 1199
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
BenchmarksBenchmark execution time: 2026-08-01 00:28:38 Comparing candidate commit 891ad67 in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 71 metrics, 0 unstable metrics, 66 known flaky benchmarks, 60 flaky benchmarks without significant changes.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
Adds
sensitivemetadata tosupported-configurations.yamland enforces redacted reads with Roslyn diagnostics. MarksDD_API_KEYand the four OTLP header settings as sensitive, then migrates their runtime reads to redacted string or dictionary accessors.Reason for change
Configuration telemetry must not record credential-bearing values. The runtime lookup proposed in #8763 would add work to tracer startup, so this draft implements the YAML-driven compile-time approach discussed there.
Implementation details
sensitiveboolean.DD0015for unsafe sensitive-key reads andDD0016when sensitivity metadata cannot be loaded safely.tracer/src.Test coverage
Datadog.Trace.Tools.Runnerbuild passed.Datadog.Tracebuilt fornet461,netstandard2.0,netcoreapp3.1, andnet6.0with 0 warnings and 0 errors.git diff --check master...HEADpassed.Other details
This is a separate draft implementation of the maintainer direction from #8763.